Service oam virtualization

ABSTRACT

A SOAM virtualization system for a network having at least first and second maintenance entities coupled to each other comprises a network controller coupled to at least one of the first and second maintenance entities through a tunnel for virtualizing a SOAM network function on the at least one of the first and second maintenance entities to which the network controller is coupled. The network controller may be coupled to the first and second maintenance entities through first and second tunnels, respectively. The first maintenance entity may an originator device, and the second maintenance entity may be a destination device, with the network controller virtualizing the SOAM network function on both devices. The network controller may send a packet containing a tunnel header and a SOAM frame via the first tunnel to the originator device, which then sends the packet containing the SOAM frame to the destination device.

FIELD OF THE INVENTION

The present disclosure relates to network service testing virtualisationand Service Operation Administration and Maintenance (SOAM)virtualisation.

BRIEF SUMMARY

In accordance with one embodiment, a SOAM virtualization system isprovided for a network having at least first and second maintenanceentities coupled to each other, the system comprises a networkcontroller coupled to at least one of the first and second maintenanceentities through a tunnel for virtualizing a SOAM network function onthe at least one of the first and second maintenance entities to whichthe network controller is coupled. In one implementation, the networkcontroller is coupled to the first and second maintenance entitiesthrough first and second tunnels, respectively. The first maintenanceentity may an originator device, and the second maintenance entity maybe a destination device, with the network controller virtualizing theSOAM network function on both devices. The network controller may send apacket containing a tunnel header and a SOAM frame to the originatordevice via the first tunnel, with the originator device including aone-way packet generator that removes the tunnel header from the packetand then sends the packet containing the SOAM frame to the destinationdevice, and the destination device receiving the packet from theoriginator device and sending the SOAM frame to the network controllerin a packet transmitted via the second tunnel.

The originator device preferably includes a two-way packet generatorthat removes the tunnel header from the packet and then sends the packetcontaining the SOAM frame in a loopback function that loops back theSOAM frame to the originator device, the originator device containing aframe inspection function receiving the looped back SOAM function thatforwards the received SOAM frame to the network controller in a packetvia the first tunnel. The originator device may include a two-way packetgenerator that removes the tunnel header from the packet and then sendsthe packet containing the SOAM frame to the destination device, thedestination device sends the SOAM frame to the network controller in apacket via the second tunnel, the network controller processes the SOAMframe and returns the processed SOAM frame to the destination device ina packet containing a tunnel header via the second tunnel, and thedestination device removes the tunnel header and then sends the packetcontaining the processed SOAM frame to the originator device.

Remote network devices may be coupled to the network controller tocreate virtual remote ports to the network controller. The remotedevices are preferably coupled to the network controller by tunnels, andthe payloads of the tunnels are preferably in SOAM frames transmittedthrough the tunnels without processing in the remote devices.

The foregoing and additional aspects and embodiments of the presentdisclosure will be apparent to those of ordinary skill in the art inview of the detailed description of various embodiments and/or aspects,which is made with reference to the drawings, a brief description ofwhich is provided next.

BRIEF DESCRIPTION OF THE DRAWINGS

The foregoing and other advantages of the disclosure will becomeapparent upon reading the following detailed description and uponreference to the drawings.

FIG. 1 is an example of message flow for prior art applications.

FIG. 2 is an example of an embodiment of service virtualization.

FIG. 3 is an example of an embodiment of service virtualization on oneremote device.

While the present disclosure is susceptible to various modifications andalternative forms, specific embodiments or implementations have beenshown by way of example in the drawings and will be described in detailherein. It should be understood, however, that the disclosure is notintended to be limited to the particular forms disclosed. Rather, thedisclosure is to cover all modifications, equivalents, and alternativesfalling within the spirit and scope of an invention as defined by theappended claims.

DETAILED DESCRIPTION

Network Service, Operation, Administration and Maintenance (SOAM)includes functions such as fault management (detection, verification,localization and notification), delay measurement, packet lossdetection, client failure signaling, and vendor-specific informationapplied on a Maintenance Entity (ME). An ME is an entity that needs tobe managed in the network, and is typically located on a subscriber,operator or service provider network. SOAM functions are difficult tomanage, generally computationally intensive and do not scale well inlarge networks, such as, for example, in Software-Defined Networks(SDN). A Two-way Active Measurement Protocol (TWAMP) is an example of aSOAM function that is difficult to scale.

A Network Functions Virtualization (NFV) is a network architectureconcept that uses virtualization-related technologies to virtualizeentire classes of network node functions into building blocks that maybe connected, or linked/chained together to create communicationservices. NFV implements network functions running on proprietaryhardware distributed in a network into software modules that run into avirtual server/controller to leverage (high volume) standard servers andIT virtualization. The objective is to support multiple versions inparallel and to allow use of a single physical platform/server fordifferent applications and users.

A Virtualized Network Function (VNF) may consist of one or more virtualmachines running different software and processes, on top of industrystandard high volume servers, switches and storage, or even cloudcomputing infrastructure, instead of having custom hardware appliancesfor each network function. The main advantage comes from the facility toinnovate toward new network functions and services that are onlypractical in a pure software network environment with assisted hardware(e.g., FPGA). The functions and services can be deported onto a remotecentralized server/controller. Rather than upgrading remoteunits/devices spread over a whole network to modify any existingfunctions or services, centralized functions and services allow for newfeature introduction or correction more easily without impactingpotentially thousands of units/devices. The objective is to minimize theunit/device specific features that can only be supported on suchdedicated and specialized devices.

There is a need to virtualize the SOAM functions to centralize theprocessing on highly computation capable servers, allowing for easiermanagement, maintenance and greater scalability. For example, generationand inspection of test packets is computationally expensive and therelated statistics require a lot of memory. This function is difficultto implement on devices that have limited hardware resources (CPU,memory) such as Small-Form Pluggable (SFP) devices.

SOAM virtualization is particularly well adapted for slow protocols thatmay be redirected to a controller, while remote devices manage locallythe data plane for line rate frames/packets processing.

For example, SOAM supports Continuity Check Messages (CCMs) that areused to detect failures between two endpoints. The CCMs may be sent at ahigh rate with generally the same content (except for an optionalsequence number that is relatively easy to generate). The remote devicemay send CCMs and receive CCMs locally without intervention of thenetwork controller, but when a CCM with different content is received(or required to be sent), then the network controller is involved toperform the more complex analysis.

FIG. 1 shows an example of prior-art SOAM performance monitoring betweentwo MEs 101 and 102 over a network 100. In this case the MEs implementall the SOAM protocol. An originator device 101 may include a one-waypacket generation function 120 that creates a packet 125 destined for adestination device 102. The packet contains information required for themonitoring such as, for example, a timestamp and/or frame counter. Thedestination device 102 generally includes a packet inspection function135 to compute different measurements (e.g., delay, jitter, loss) basedon the information provided in the test packet. The test originatordevice 101 may also include a two-way packet generation 130 to performtwo-way performance monitoring 110 over the network 100. In this case,the destination device 102 loops back 140 the packet and resends to thetest originator device 101, which also generally includes a packetinspection function 145 to compute the statistics.

FIG. 2 shows an example of an embodiment where a network controller 200is used to virtualize a SOAM network function on both an originatordevice 101 and a destination device 102. It should be understood thatonly one of the devices could be virtualized, while the other deviceimplements the full functionality locally without requiring a connectionto the network controller 200 as shown in FIG. 3.

In the system illustrated in FIG. 2, standard communication tunnels 201and 202 are used to communicate with the network devices 101 and 102respectively. In the case of a one-way SOAM function 220, the originatordevice 101 receives a tunnel packet containing a tunnel header and aSOAM frame from the network controller 200 via the tunnel 201. A frameforwarder 230 in the originator device 101 then removes the tunnelheader from the packet and, if required, may add a timestamp to thepacket before sending the packet to the destination device 102. It willbe understood that the network controller 200 handles all the processingand frame payload required to generate the SOAM frame contained in thetunnel payload. Additional metadata (e.g., the port to use and theaddress of destination device) may optionally be added to the tunneledpacket to instruct the frame forwarder on the device 210 to performspecific tasks on the frame prior to sending (e.g., push/pop of a VLANheader, adding the timestamp).

In the destination device 102, a frame forwarder 230 adds a receptiontimestamp and sends the received SOAM frame in a tunneled packet, alongwith optional metadata, to the network controller 200, which performsthe statistics computation and storage. In the case of a two-way OAMfunction 245, the network controller 200 generates a packet and sends itto the two-way frame generator 225 of the originator device 101 via thestandard tunnel 201 along with optional metadata. The frame forwarder230 removes the tunnel header, and may add a timestamp and perform otherfunctions as per the metadata, and then sends the packet to thedestination device 102. A loopback function 140 in the destinationdevice 102 loops back the SOAM frame so that it may be received by theframe forwarder 230 located in the originator device 101. The frameforwarder 230 may add a reception timestamp, along with optionalmetadata, and then forwards the received SOAM frame in a tunneled packetto the network controller 200 for statistics processing and storage.

A plurality of network controllers can be implemented in a network. Theymay control a distinct set of devices or control the same devices butfor different functions.

In another embodiment, the loopback function 140 can also bevirtualized. In this case, the SOAM frame is sent to the networkcontroller in a tunneled packet for processing of the originating frame.Then the reply SOAM frame is sent from the network controller in atunneled packet before it is returned to the originating device via thedestination device 102, after the device 102 has removed the tunnelheader and may have added a timestamp and performed other functions asper the metadata.

Remote devices spread in the network are linked to the networkcontroller as virtual remote ports. The link between the controller andthe remote devices to create those virtual remote ports is illustratedby the tunnels shown in FIGS. 2 and 3. The NFV embodiment does notpreclude having proxy or “coprocessor” functions executed in the remotedevices having hardware processing capabilities (e.g., FPGA). Dependingon the processing and capability of the remote device, more or lessfunctionality can be implemented directly on the remote device, whilethe rest is offloaded to the network controller.

The modules such as the SOAM module running in the network controllermust be able to use ports found on remote devices as virtual remoteports in a way that they are seen as extensions to the physical portsdirectly connected to the network controller itself. The controllerfirst discovers remote devices deployed in the network through its ownlocal ports connected to the network using a proprietary or IP agnosticdiscovery protocol. The controller may in fact use many discoveryprotocol instances in order to adapt to the network environment anddiscover all the remote devices the need to be managed. The proprietarydiscovery protocol is applied in layer 2 (Ethernet) networks using aproprietary Ethernet type and operational code, or in layer 3 (UDP/IP)networks using a proprietary destination UDP port combined with anotheroperational code in the UDP payload. The IP agnostic discovery protocolis similar to the layer 3 proprietary one having the same destinationUDP port and operational code in the UDP payload except it is notrequired to have the destination IP address corresponding to a remotedevice.

The IP agnostic discovery mode uses a network element unicastdestination IP address that is found farther in the network so remotedevices can be discovered in the path to the destination. Each remotedevice receiving such discovery frame or packet responds with anadvertisement frame/packet to let the originator know about its owncharacteristics and attributes, such as device type, speed, base MACaddress, applications running locally and port status. Once that isdone, the controller establishes a secured session with the remotedevice based on a stream cipher (such as Grain-128a) that allowsexchanges of control and management packets. This secured session isalso used to report to the controller the remote devices' port status sothat modules, protocols and even the kernel are able to report anup/down status that reflects not only the status of the local connectionon the devices, but also the status of the session.

The controller adds the remote devices' ports into the list of portsavailable to modules, protocols and features (e.g., SOAM, ServiceActivation Testing) running on the controller. If a module uses one ofthe remote virtual ports, then it is up to the controller's system andkernel to encapsulate the messages, frames or packets to the propertunnel managed through the secured session.

Thus, frames or packets sent/received through a virtual remote port andsent to/coming from a network controller are authenticated using thesame stream cipher. The traffic is sent and received using a tunnelrepresented by the secured session set up between the remote devices andthe network controller. In the tunnel, the payload of the securedpackets represents the actual SOAM frame in this application that isexchanged with the endpoint indirectly connected to the controllerthrough a remote device linked to it. The SOAM frames exchanged are theactual payload of the tunnel without further processing on the remotedevices, so the complete processing can be done at the networkcontroller level. Depending on the network topology, the tunnel maysupport no other header, but may also support VLAN and VLAN-in-VLANheaders so that the tunneled packets can be managed properly in variousnetwork topologies.

In another embodiment, one remote device may send OAM frames, such as aLink Trace message, while the other endpoint sends a Link Trace reply.In the path from one endpoint to the other, intermediate remote devicesmay redirect the OAM frames, following predetermined policiesestablished in hardware assisted capable devices so that such action asadding a timestamp is possible. The frame is sent to the controllerwithin a secured tunnel that is represented, as mentioned above, by thesecured session based on the stream cipher. The network controller, uponreceiving the secured packet, extracts its payload which is in fact theOAM frame that is to be processed. Then, the controller processes theOAM frame that was received from a remote virtual port linked to it byadding the proper information into the Link Trace message sent fromfirst endpoint. Once this is done, the network controller sends the OAMframe, modified with proper information, back to the remote device usingan encapsulated frame (tunnel). The remote device extracts the OAM framefrom the payload contained in the secured packet by removing theencapsulation (secure) header, and then forwards the packet to theproper egress port. The OAM frame is then directed toward the nextintermediate remote device doing the same processing, either locally orusing an associated network controller, until the OAM frame reaches thedestination device. The two endpoints are not aware that the frames aregoing through remote controllers. From the endpoints' perspective, theOAM frames are being received and processed by remote devices withoutknowing what other processing is happening on the frames sent andreceived through other devices or network entities other than the onesfound in the direct path between the endpoints.

As part of the NFV framework, remote devices must have the capability toclassify frames, such as OAM frames, and be able to take actions on eachif required. The actions may include any of the following: loopback andtimestamp, forward (from one port to the other), drop, timestamp andsend to local CPU, or timestamp and send to remote network controllerfor VNF processing. The remote devices classify frames following variouspredetermined criteria such as the Layer 2 or Ethernet header, Layer 3or IP header and/or Layer 4 or TCP/UDP header content. The NFV frameworkcan provide the capability to load, execute and move VNFs acrossdifferent network elements/remote devices, thus increasing the entireVNF scalability and performance. The NFV framework can provide thecapability in terms of infrastructure capacity, performance andstability to optimize the location, reservation and allocation of therequired resources of the VNFs. The NFV can report the exact networkfunctions location and allocation to network entities/units so thaterror reporting can be associated accordingly, but also adapt, whenrequired, the activation of VNFs depending on the underlyinginfrastructure to ensure that the SLA expected for one feature/functionwill be respected.

The NFV framework established between remote devices and one or morenetwork controllers needs to allow partial or fully virtualized networkfunctions (VNFs). Partial VNFs can be, for example, having SOAM LinkTrace messages being processed solely by the network controller withoutany processing of the SOAM frame by the remote device, while having theSOAM delay measurement (DM) frames processed solely by the remotedevices without having any processing by any network controller. Ifdeemed necessary in time, the processing of the SOAM DM frames can befully virtualized to the same network controller but in a second phaseof deployment. In all cases, the NFV framework expects the devices andnetwork controller to be able to adapt to partial or fully virtualizedfunctions that may vary in time, to take fully advantage of VNFssupported in one or more virtual machines running differentapplications, modules and processes.

So, whether the services are tied to SOAM protocols, TWAMP protocols, orany other protocol, they can execute in parallel as they are distinctframes and protocols that require different classifications, actions andprocessing, as described above. Whether they are virtualized through aremote virtual network function running on a remote server/controller oron a remote device itself, they are supported in parallel by takingadvantage of the network elements capabilities and processing poweroffered by the devices or the network controller instances supported byvirtual machines.

The network controller may be linked and shared between potentiallythousands of remote devices. The software oriented features and modulesevolve separately from the hardware features and devices, and viceversa. The hardware devices are as generic as possible in terms offeatures/functions. Time sensitive functions are particularly targetedto be supported in the existing hardware devices with the assistance ofthe FPGA component. Control and data plane packets time stamping is onegood illustration of function that is to be managed by hardware devicesonly, considering the need to have high precision and consideration forline rate processing.

Although the algorithms described above, including those with referenceto the foregoing flow charts have been described separately, it shouldbe understood that any two or more of the algorithms disclosed hereincan be combined in any combination. Any of the methods, algorithms,implementations, or procedures described herein can includemachine-readable instructions for execution by: (a) a processor, (b) acontroller, and/or (c) any other suitable processing device. Anyalgorithm, software, or method disclosed herein can be embodied insoftware stored on a non-transitory tangible medium such as, forexample, a flash memory, a CD-ROM, a floppy disk, a hard drive, adigital versatile disk (DVD), or other memory devices, but persons ofordinary skill in the art will readily appreciate that the entirealgorithm and/or parts thereof could alternatively be executed by adevice other than a controller and/or embodied in firmware or dedicatedhardware in a well known manner (e.g., it may be implemented by anapplication specific integrated circuit (ASIC), a programmable logicdevice (PLD), a field programmable logic device (FPLD), discrete logic,etc.). Also, some or all of the machine-readable instructionsrepresented in any flowchart depicted herein can be implemented manuallyas opposed to automatically by a controller, processor, or similarcomputing device or machine. Further, although specific algorithms aredescribed with reference to flowcharts depicted herein, persons ofordinary skill in the art will readily appreciate that many othermethods of implementing the example machine readable instructions mayalternatively be used. For example, the order of execution of the blocksmay be changed, and/or some of the blocks described may be changed,eliminated, or combined.

It should be noted that the algorithms illustrated and discussed hereinas having various modules which perform particular functions andinteract with one another. It should be understood that these modulesare merely segregated based on their function for the sake ofdescription and represent computer hardware and/or executable softwarecode which is stored on a computer-readable medium for execution onappropriate computing hardware. The various functions of the differentmodules and units can be combined or segregated as hardware and/orsoftware stored on a non-transitory computer-readable medium as above asmodules in any manner, and can be used separately or in combination.

While particular implementations and applications of the presentdisclosure have been illustrated and described, it is to be understoodthat the present disclosure is not limited to the precise constructionand compositions disclosed herein and that various modifications,changes, and variations can be apparent from the foregoing descriptionswithout departing from the spirit and scope of an invention as definedin the appended claims.

1-24. (canceled)
 25. A system for operating a Service, Operation,Administration and Maintenance (SOAM) virtualization system for anetwork, said system comprising one or more network controller, coupledto a plurality of devices; a first of said network controller transmitsa first packet to a first of said plurality of devices, said firstpacket comprising a first SOAM frame and metadata specifying one or moreoperations to perform on one or more parameters of said SOAM frame; saidfirst device receives said first packet and modifies said parameters ofsaid first SOAM frame by performing said one or more operations toproduce a modified SOAM frame, said first device forwards said firstpacket comprising said modified SOAM frame to a second device over saidnetwork; said second device, in response to receiving said first packetcomprising said modified SOAM frame, transmits a second packetcomprising a reply SOAM frame to said first device; said first devicereceiving said second packet comprising said reply SOAM frame andforwarding said reply SOAM frame to said first network controller; andsaid first network controller processing said reply SOAM frame.
 26. Thesystem of claim 25, wherein: said second device forwards said packetcomprising said modified SOAM frame to a second network controller, andsaid second network controller generates said second packet comprisingsaid reply SOAM frame; and said second device receives said secondpacket comprising said reply SOAM frame from said second networkcontroller.
 27. The system of claim 26, wherein said first networkcontroller and said second network controller are the same.
 28. A methodof operating a Service, Operation, Administration and Maintenance (SOAM)virtualization system for a network, said method comprising:transmitting a first packet by a first on one or more networkcontroller, to a first device, comprising a SOAM frame and metadataspecifying one or more operations to perform on one or more parametersof said SOAM frame; receiving by said first device said first packet andmodifying said parameters of said SOAM frame by performing said one ormore operations to produce a modified SOAM frame; forwarding by saidfirst device said first packet comprising said modified SOAM frame to asecond device over said network; receiving by said second device, saidfirst packet comprising said modified SOAM frame, and transmitting asecond packet comprising a reply SOAM frame to said first device;receiving by said first device, said second packet comprising said replySOAM frame and forwarding said reply SOAM frame to said networkcontroller; and processing at said network controller said reply SOAMframe.
 29. The method of claim 28 further comprising: forwarding by saidsecond device said first packet comprising said modified SOAM frame to asecond network controller, said second network controller generatingsaid second packet comprising said reply SOAM frame; and receiving bysaid second device said second packet comprising said reply SOAM framefrom said second network controller.
 30. The method of claim 29 whereinsaid first network controller and said second network controller are thesame.